Hashcat outputting blank result (pdf crack)?

[staze]

Hi All,

I'm trying to crack a PDF using Hashcat 4.0.1-4-gfddb66eb (Mac OS X 10.13.1), and giving it a dictionary attack. It quickly finds the password, and reports: 

Code:

Session..........: hashcat
Status...........: Cracked
Hash.Type........: PDF 1.4 - 1.6 (Acrobat 5 - 8)
Hash.Target......: $pdf$4*4*128*2052*1*16*00******** (redacted)
Time.Started.....: Mon Nov 13 09:49:19 2017 (1 sec)
Time.Estimated...: Mon Nov 13 09:49:20 2017 (0 secs)
Guess.Base.......: File (~/awesome-wordlist.dict)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#2.....:  3297.2 kH/s (113.82ms)
Speed.Dev.#3.....:  3292.2 kH/s (113.88ms)
Speed.Dev.#*.....:  6589.4 kH/s
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 1603292/1844826117 (0.09%)
Rejected.........: 30428/1603292 (1.90%)
Restore.Point....: 0/1844826117 (0.00%)
Candidates.#2....:  -> blahblah
Candidates.#3....: 01731364116 -> 04:01:1351

 

Awesome. Then I look in the output file, or the potfile, and I just see the hash for the pdf, then a colon at the end, then blank. Nothing. Nada. 

I've obviously tried a blank password, but it doesn't work. Anyone seen this? am I missing some flag in my hashcat command (./hashcat -m 10500 -a 0 ~/Desktop/pdfhash.txt ~/awesome-wordlist.dict -o ~/Desktop/crackedpdf.txt)?

[staze]

Hmm, might have found the answer:

https://hashcat.net/forum/thread-5148.html

But, I don't get why this is the case. The hash was cracked... maybe pdf2john is outputting something wrong. =/

[staze]

Yup, I see now that hashcat doesn't crack restriction password if there's no file password.

I'm dumb. Thanks!

[royce]

Not dumb - just learning. Glad you found an answer (from yourself, even!)